The ICO becomes the Information Commission on 30 September: what changes and what doesn't

The Information Commissioner's Office "will transition to the Information Commission on 30 September 2026", the regulator said in a notice dated 15 September. The legal switch is made by commencement regulations signed on 10 September. Here is what the official sources say changes on Wednesday, and what does not.

What changes on 30 September

• The Commissioner's office is abolished and a Commission takes over. The Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/1015) bring three provisions of the 2025 Act into force "on 30th September 2026": section 117(4)(a), section 118 ("abolition of the office of Information Commissioner") and section 119 ("transfer of functions to the Information Commission").
• The functions move across unchanged in law. Section 119 says "The functions of the Information Commissioner are transferred to the Information Commission", and that a reference to the Commissioner in legislation "or other document" is to be treated as a reference to the Commission, so far as is appropriate.
• A board, not a single office-holder. The ICO says the Act "makes changes to the governance structure of our organisation, while maintaining existing regulatory functions and responsibilities". Seven non-executive members appointed in July "will assume their new roles on 30 September", according to the ICO. Its July statement said the government had launched recruitment for a Chair, with applications closing on 19 August; we did not find a primary source confirming an appointment.

What does not change

• The name you will see. The ICO's notice was updated on 17 September to say: "As the Information Commission's Office, we will continue to be known as the ICO."
• Cases already under way. Regulation 3 of SI 2026/1015 says anything "in the process of being done" by or in relation to the Commissioner before 30 September, "including legal proceedings", is to be treated as done by or in relation to the Commission, and "capable of being continued".
• Your obligations under data protection law. On our reading of the regulations, nothing in the three provisions commenced on 30 September changes UK GDPR duties for businesses; the change is about who the regulator is, not what the rules are.

Already in force: the AI-relevant changes

On our reading, the rules most relevant to AI and automated systems arrived earlier, not on 30 September.

• Automated decision-making. Section 80 of the 2025 Act replaced Article 22 of the UK GDPR; the note to SI 2026/1015 lists it as in force from 5 February 2026. A decision is "based solely on automated processing if there is no meaningful human involvement". Where a significant decision is taken that way, the controller "must ensure that safeguards" are in place, including measures that let people get information about the decision, "make representations", "obtain human intervention" and "contest such decisions". The ICO says the change "opens up the full range of reasons, or ‘lawful bases’" for significant automated decisions, "So long as you continue to apply appropriate safeguards", and that this "doesn’t apply to special category data which is more protected". The Act also says such a decision "may not be taken based solely on automated processing" where the processing is carried out "entirely or partly" in reliance on the new recognised legitimate interests basis (Article 6(1)(ea)).
• Complaints to organisations. Section 103 requires controllers to "facilitate the making of complaints", for example with "a complaint form which can be completed electronically and by other means", and to acknowledge receipt "within the period of 30 days beginning when the complaint is received". The note to SI 2026/1015 lists section 103 as in force from 19 June 2026, and the ICO said on 23 June that "All organisations must now give people a clear way to raise a data protection complaint, acknowledge it within 30 days, investigate appropriately and communicate the outcome."
• The regulator's duties. Section 91 sets a "principal objective" to "secure an appropriate level of protection for personal data" and "promote public trust and confidence", and requires the regulator to have regard to matters including "the desirability of promoting innovation". The Commission inherits these duties with the other functions under section 119, which says a reference to the Information Commissioner in an enactment "is to be treated as a reference to the Information Commission".
• An AI code is on the way. In June the ICO said it is "starting work on a new statutory code of practice on artificial intelligence and automated decision making", with timings to follow.

What you need to do

The ICO's notice sets out no new action for organisations because of the rename; it says the focus is "a smooth transition and continuity of service". If you have not yet acted on the earlier changes, the ICO points organisations to its data protection complaints guidance and its draft guidance on automated decision-making. Check the ICO's guidance rather than relying on summaries, including this one.

Why it matters

On our reading, most small businesses will notice little on Wednesday: same name, same law, same open cases. The substantive shifts for anyone using automated or AI-driven decisions about people came in February and June, and the ICO's planned statutory code on AI and automated decision-making is the next thing to watch.